Embed Splunk dashboard elements in third party software
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Contents
Embed Splunk dashboard elements in third party software
Take any chart or graph created by Splunk and embed it in another web application. Currently, Splunk does not have single sign-on implemented, so you will have to use an insecure login to authenticate against Splunk.
CAUTION: Anybody with access to the page can get the user credential by viewing the page source.
Enable insecure login
First, enable insecure login via web.conf by adding the following stanza:
[settings] enable_insecure_login = true ...
Then, you must restart Splunk.
If you're unfamiliar with how Splunk configuration files work, read the Admin manual topic about configuration files.
Create your view in Splunk
Next create a view XML that contains the element you want to embed in your third party app (for example, a graph or chart). The view should contain only the modules you want to display in your portal, so you'll want to strip out any of the Splunk chrome. This view cannot use the simple XML; it must be written in advanced XML. Save your view in $SPLUNK_HOME/etc/apps/<app_name>/local/data/ui/views/<view_name>.xml
example view
Here's an example view that has all the Splunk chrome stripped out. This view just shows a chart driven by a hidden search.
<view template="dashboard.html">
<module name="HiddenSearch" autoRun="True" layoutPanel="panel_row1_col1">
<param name="search">sourcetype=access_common | timechart span=5m count</param>
<param name="earliest">-24h</param>
<module name="HiddenChartFormatter">
<param name="chart">line</param>
<param name="primaryAxisTitle.text">Time</param>
<param name="legend.placement">bottom</param>
<param name="chartTitle">Stuff past 24 hours</param>
<module name="JobProgressIndicator"/>
<module name="FlashChart"/>
</module>
</module>
</view>
Refresh your view when you make changes to it by loading this URI:
https://localhost:8089/servicesNS/<user_name>/<app_name>/data/ui/views?refresh=1
Note: Replace host and port with your host and management port.
Create an iframe in your site
Finally, iframe the view you've created into your third party app, via the /insecurelogin endpoint:
http://splunkserver:8000/account/insecurelogin?username=admin&password=changeme&return_to=/app/foo/myview
Remember that the value of the “return_to” parameter must be URI-escaped. Also, replace username and password with the username and password you'd like to use. The resulting HTML page will render that view within the iframe element.
example HTML
Here's an example of adding an iframe into HTML:
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Splunk Stuff</title> </head> <body> <!-- content starts here --> <h1>Hey Look At My Pretty Pictures!</h1> <iframe src ="http://myhost:8000/account/insecurelogin?username=test_user&password=changeme&return_to=%2Fapp%2Fmy_test_app%2Fmy_view" width="100%" height="300"> <p>Your browser does not support iframes.</p> </iframe> <!-- content ends here --> </body> </html>
This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10 , 4.0.11 View the Article History for its revisions.